CVE-2024-56333

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-56333", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-12-19T18:39:53.612Z", "datePublished": "2024-12-20T19:52:25.818Z", "dateUpdated": "2024-12-24T16:38:50.448Z"}, "containers": {"cna": {"title": "Remote code execution in onyxia-api", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "baseScore": 9.4, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0"}}], "references": [{"name": "https://github.com/InseeFrLab/onyxia/security/advisories/GHSA-qmcw-h4f9-j3h3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/InseeFrLab/onyxia/security/advisories/GHSA-qmcw-h4f9-j3h3"}, {"name": "https://docs.onyxia.sh/vulnerability-disclosure/known-vulnerabilities/vulnerability-20241219", "tags": ["x_refsource_MISC"], "url": "https://docs.onyxia.sh/vulnerability-disclosure/known-vulnerabilities/vulnerability-20241219"}], "affected": [{"vendor": "InseeFrLab", "product": "onyxia", "versions": [{"version": "< 2.8.2", "status": "affected"}, {"version": ">= 3.0.0, < 3.1.1", "status": "affected"}, {"version": ">= 4.0.0, < 4.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-12-20T19:52:25.818Z"}, "descriptions": [{"lang": "en", "value": "Onyxia is a web app that aims at being the glue between multiple open source backend technologies to provide a state of art working environment for data scientists. This critical vulnerability allows authenticated users to remotely execute code within the Onyxia-API, leading to potential consequences such as unauthorized access to other user environments and denial of service attacks. This issue has been patched in api versions 4.2.0, 3.1.1, and 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability."}], "source": {"advisory": "GHSA-qmcw-h4f9-j3h3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-12-24T16:38:39.255348Z", "id": "CVE-2024-56333", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-24T16:38:50.448Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-56333", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-12-24T16:38:39.255348Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-24T16:38:46.419Z"}}], "cna": {"title": "Remote code execution in onyxia-api", "source": {"advisory": "GHSA-qmcw-h4f9-j3h3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "InseeFrLab", "product": "onyxia", "versions": [{"status": "affected", "version": "< 2.8.2"}, {"status": "affected", "version": ">= 3.0.0, < 3.1.1"}, {"status": "affected", "version": ">= 4.0.0, < 4.2.0"}]}], "references": [{"url": "https://github.com/InseeFrLab/onyxia/security/advisories/GHSA-qmcw-h4f9-j3h3", "name": "https://github.com/InseeFrLab/onyxia/security/advisories/GHSA-qmcw-h4f9-j3h3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://docs.onyxia.sh/vulnerability-disclosure/known-vulnerabilities/vulnerability-20241219", "name": "https://docs.onyxia.sh/vulnerability-disclosure/known-vulnerabilities/vulnerability-20241219", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Onyxia is a web app that aims at being the glue between multiple open source backend technologies to provide a state of art working environment for data scientists. This critical vulnerability allows authenticated users to remotely execute code within the Onyxia-API, leading to potential consequences such as unauthorized access to other user environments and denial of service attacks. This issue has been patched in api versions 4.2.0, 3.1.1, and 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-12-20T19:52:25.818Z"}}}, "cveMetadata": {"cveId": "CVE-2024-56333", "state": "PUBLISHED", "dateUpdated": "2024-12-24T16:38:50.448Z", "dateReserved": "2024-12-19T18:39:53.612Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-12-20T19:52:25.818Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "onyxia", "vendor": "InseeFrLab", "versions": [{"status": "affected", "version": "< 2.8.2"}, {"status": "affected", "version": ">= 3.0.0, < 3.1.1"}, {"status": "affected", "version": ">= 4.0.0, < 4.2.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Onyxia is a web app that aims at being the glue between multiple open source backend technologies to provide a state of art working environment for data scientists. This critical vulnerability allows authenticated users to remotely execute code within the Onyxia-API, leading to potential consequences such as unauthorized access to other user environments and denial of service attacks. This issue has been patched in api versions 4.2.0, 3.1.1, and 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "Onyxia es una aplicaci\u00f3n web que tiene como objetivo ser el nexo de uni\u00f3n entre m\u00faltiples tecnolog\u00edas backend de c\u00f3digo abierto para proporcionar un entorno de trabajo de \u00faltima generaci\u00f3n para los cient\u00edficos de datos. Esta vulnerabilidad cr\u00edtica permite a los usuarios autenticados ejecutar c\u00f3digo de forma remota dentro de la API de Onyxia, lo que puede tener consecuencias como el acceso no autorizado a otros entornos de usuario y ataques de denegaci\u00f3n de servicio. Este problema se ha corregido en las versiones de la API 4.2.0, 3.1.1 y 2.8.2. Se recomienda a los usuarios que actualicen la versi\u00f3n. No se conocen workarounds para esta vulnerabilidad."}], "id": "CVE-2024-56333", "lastModified": "2026-06-17T08:12:03.850", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-56333", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-12-24T16:38:39.255348Z", "version": "2.0.3"}}]}, "published": "2024-12-20T20:15:24.520", "references": [{"source": "security-advisories@github.com", "url": "https://docs.onyxia.sh/vulnerability-disclosure/known-vulnerabilities/vulnerability-20241219"}, {"source": "security-advisories@github.com", "url": "https://github.com/InseeFrLab/onyxia/security/advisories/GHSA-qmcw-h4f9-j3h3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}